Proactive link load balancing to maintain quality of link

ABSTRACT

Disclosed embodiments describe systems and methods for predicting health of a link. A device in communication with a link can identify profile information of a stream of network traffic traversing the link. The device can determine a first prediction of health of the link by applying one or more rules to the plurality of parameters of the profile information. The device can determine a second prediction of health of the link by applying a classifier to one or more timed sequences of the plurality of parameters of the profile information. The device can establishes a respective weight for each of the first prediction of health and the second prediction of heath. The device can select, using the respective weight, between the first prediction of health and the second prediction of health to provide a predictor of the health of the link.

CROSS-REFERENCE TO RELATED APPLICATION

This patent application is a continuation of, and claims priority to andthe benefit of U.S. patent application Ser. No. 15/660,147, titled“PROACTIVE LINK LOAD BALANCING TO MAINTAIN QUALITY OF LINK,” and filedJul. 26, 2017, the contents of all of which are hereby incorporatedherein by reference in its entirety for all purposes.

FIELD OF THE DISCLOSURE

The present application generally relates to methods and systems forpredicting the health of a network link.

BACKGROUND

Data can be transmitted across one or more links in a network. The stateof a link in the network can affect the quality of the networkconnection and, therefore, the quality of the transmission. For example,a link in a bad state can experience greater packet loss, jitter orlatency as compared to a link in a good state. Due to the technicalchallenges in identifying the state of a link or a cause of the state ofthe link, it can be difficult to select a link for data transmission orimprove the state of a link.

SUMMARY

This Summary is provided to introduce a selection of concepts in asimplified form that are further described below in the DetailedDescription. This Summary is not intended to identify key features oressential features, nor is it intended to limit the scope of the claimsincluded herewith.

The present disclosure is directed to systems and methods for predictinghealth of a link. In a network, such as a wide area network (WAN), itcan be challenging to identify links that are in a good state, identifythe cause of a link entering a bad state, predict the future state of alink, or proactively prevent a link from entering a bad state. A deviceintermediary between a client and a server, such as a network applianceor a middlebox, attempts to facilitate or improve load balancing of datatransmission across links by utilizing links that are in a good state totransmit data. Middleboxes that perform WAN virtualization can beconfigured as a pair of devices connected via different WAN networks.The middleboxes can determine the best link to send the high prioritypackets (traffic) by determining the packet loss, latency, jitter,congestion and other network entities from each of the links. Forexample, given a set of links between two middleboxes, networkthroughput or reliability can be improved by load balancing the dataacross good links that experience less packet drops, latency and jitter,as opposed to bad links. An active link (path) between the middleboxescan either be in a good state or a bad state based on the loss, latency,and jitter. The middlebox can be configured to choose a link or paththat is in a good state as opposed to a link that is in a bad state(e.g., a link that experiences more packet loss, jitter and latency) toprovide better QoS for the connections. Thus, maintaining more links ina good state can provide better quality of service (QoS) for theconnections as it can provide the middlebox with more options from whichto choose a link to send packets.

Factors that can cause a link to enter a bad state include, for example,high latency, high packet drop or high jitter. If the device candetermine the cause of the link entering the bad state, the device canrecover the link from that state. For example, if high jitter is thecause for a link from going bad, the device can remove the factors fromthe appliance end for that link that cause high jitter, therebypreventing the link from going to bad state.

Further, since the device selects good links to transport the packetsreliably, the device can increase the load on good links. This can causethe good links to experience high jitter and loss and, eventually, entera bad state. Systems and methods of the present disclosure can improvethe use of the links by avoiding this cascading effect by predicting acause of a link entering a bad state, and performing an action based onthe cause to prevent the link from entering the bad state, such asredistributing traffic of certain connections. The intermediary devicecan prevent the best links from entering a bad state, and maintain ahigher number of good quality links in the WAN.

Thus, systems and methods of the present disclosure allow a device todynamically predict link health and take action based on the link healthto prevent the link from going bad. Proactively managing link health orquality can prevent cascading effects of links going bad due tooverloading. Further, the device can maintain a greater number of linksin a good state.

To do so, the device can use predictive algorithms to detect a cause ofa link entering a bad state or, a cause of a link entering a bad statein the future, and take actions based on the predicted cause to preventthe link from entering the bad state or recovering the link from the badstate. Thus, the device can maintain a high number of good qualitylinks.

The device can identify, determine or predict the state (or health) of alink based on one or more parameters. The device can perform proactiveconnection management based on the parameters. For example, the devicecan be configured with a hybrid prediction mechanism that can include aset of static rules and an online machine learning classifier. Thestatic rules can be empirically composed of link health definingparameters. The online machine learning classifier can learn over theseparameters. The prediction output by the static rules and the predictionoutput by the online machine learning classifier can be weighted andcombined to generate a final prediction that indicates whether a link isentering a bad state, as well as the cause of the link entering the badstate. The device can perform a proactive action or decision based onthe cause in order to maintain the state or health of the link. Thedevice can apply weights to the predictions that can be a function oftime and accuracy of the respective tools.

To detect what causes a link to go to a bad state, the device canidentify one or more variables, such as high packet drop, high jitter orhigh latency. The device can determine that the link can enter a badstate if any one or more of these variables is greater than a threshold.The device can predict that a link would experience one or more of highpacket drop, high jitter or high latency based on patterns andrelationships. These patterns and relationships can be referred to as afeature set.

For example, an increase in packet drop can be determined from acombination of: increase in link utilization; increase in link latency;synchronization of window size; rate of increase of number ofconnections (burst); and type of connections (e.g., bulk, chatty, orstream). In another example, the increase in jitter can be determinedby: difference in inter-arrival time in the queue, and the inter-arrivaltime to send the packets from the queue; average queue size; and currentqueue size. In yet another example, the increase in packet drop can bedetermined by: queue size; minimum latency; type of connection; andnumber of connections. The device can leverage the relationships acrossthe various learning algorithms, by using prediction algorithms topredict what parameters can cause the link to fail (or enter a badstate) in the future.

At least one aspect of the present disclosure is directed to a methodfor predicting health of a link. A device in communication with a linkcan identify profile information of a stream of network traffictraversing the link. The profile information can include a plurality ofparameters about the link. The device can determine a first predictionof health of the link by applying one or more rules to the plurality ofparameters of the profile information. The device can determine a secondprediction of health of the link by applying a classifier to one or moretimed sequences of the plurality of parameters of the profileinformation. The device can establish a respective weight for each ofthe first prediction of health and the second prediction of heath. Thedevice can use the respective weight to select between the firstprediction of health and the second prediction of health to provide apredictor of the health of the link.

In some embodiments, the plurality of parameters the device can collectfor the profile information includes two or more of the following:latency, utilization, loss of packets, jitter, queue size, number ofconnections, and type of connection. In some embodiments, the deviceapplies the one or more rules as a function of the plurality ofparameters comprising loss of packets, latency and jitter. The functioncan be a sum of multiplying each of the plurality of parameters by arespective constant.

In some embodiments, the device can create the one or more timedsequences of the plurality of parameters responsive to the health of thelink one of climbing above or falling below a predetermined threshold.The device can apply a function to a first weight of the firstprediction of health and a second weight of the second prediction ofhealth to select between the first prediction of health and the secondprediction of health.

In some embodiments, the device can take an action associated with thelink responsive to the predictor of the health of the link. The devicecan identify, via the selected predictor of the health of the link, thatthe link has high latency based on a predetermined latency threshold.The device can move one or more connections with packet occupancygreater than a predetermined occupancy threshold in a queue to one ormore other links. In some embodiments, the device can identify, via theselected predictor of the health of the link, that the link has highjitter based on a predetermined jitter threshold, and move one or moreconnections with a difference in inter-arrival time into the device andinter-departure time of a queue of the device is above a predeterminedthreshold. In some embodiments, the device can identify, via theselected predictor of the health of the link, that the link has highloss based on a predetermined loss threshold and transmitting by thedevice a predetermined portion of bandwidth via the link.

In another aspect, the present disclosure is directed to a system forpredicting health of a link. The system can include a device thatincludes a processor coupled to memory. The device can be incommunication with a link. The device can identify profile informationof a stream of network traffic traversing the link. The profileinformation comprising a plurality of parameters about the link. Thesystem can include a rule engine that determines a first prediction ofhealth of the link by applying one or more rules to the plurality ofparameters of the profile information. The system can include aclassifier that determines a second prediction of health of the link byapplying a classifier to one or more timed sequences of the plurality ofparameters of the profile information. The system can include a weightadjuster that establishes a respective weight for each of the firstprediction of health and the second prediction of heath. The system caninclude a prediction selector that selects, using the respective weight,between the first prediction of health and the second prediction ofhealth to provide a predictor of the health of the link.

In some embodiments, the plurality of parameters the device collects forthe profile information includes two or more of the following: latency,utilization, loss of packets, jitter, queue size, number of connections,and type of connection. In some embodiments, the rule engine can applythe one or more rules as a function of the plurality of parameterscomprising loss of packets, latency and jitter. In some embodiments, thefunction is a sum of multiplying each of the plurality of parameters bya respective constant. In some embodiments, the device creates the oneor more timed sequences of the plurality of parameters responsive to thehealth of the link one of climbing above or falling below apredetermined threshold.

In some embodiments, the predictor selector applies a function to afirst weight of the first prediction of health and a second weight ofthe second prediction of health to select between the first predictionof health and the second prediction of health. In some embodiments, thedevice can take an action associated with the link responsive to thepredictor of the health of the link. The device can identify, via theselected predictor of the health of the link, that the link has highlatency based on a predetermined latency threshold, and move one or moreconnections with packet occupancy greater than a predetermined occupancythreshold in a queue to one or more other links. The device canidentify, via the selected predictor of the health of the link, that thelink has high jitter based on a predetermined jitter threshold, and moveone or more connections with a difference in inter-arrival time into thedevice and inter-departure time of a queue of the device is above apredetermined threshold. The device can identify, via the selectedpredictor of the health of the link, that the link has high loss basedon a predetermined loss threshold and transmit by the device apredetermined portion of bandwidth via the link.

BRIEF DESCRIPTION OF THE DRAWING FIGURES

Objects, aspects, features, and advantages of embodiments disclosedherein will become more fully apparent from the following detaileddescription, the appended claims, and the accompanying drawing figuresin which like reference numerals identify similar or identical elements.Reference numerals that are introduced in the specification inassociation with a drawing figure can be repeated in one or moresubsequent figures without additional description in the specificationin order to provide context for other features, and not every elementcan be labeled in every figure. The drawing figures are not necessarilyto scale, emphasis instead being placed upon illustrating embodiments,principles and concepts. The drawings are not intended to limit thescope of the claims included herewith.

FIG. 1A is a block diagram of a network computing system, in accordancewith an illustrative embodiment;

FIG. 1B is a block diagram of a network computing system for deliveringa computing environment from a server to a client via an appliance, inaccordance with an illustrative embodiment;

FIG. 1C is a block diagram of a computing device, in accordance with anillustrative embodiment;

FIG. 2 is a block diagram of an appliance for processing communicationsbetween a client and a server, in accordance with an illustrativeembodiment;

FIG. 3 is a block diagram of a virtualization environment, in accordancewith an illustrative embodiment;

FIG. 4 is a block diagram of a cluster system, in accordance with anillustrative embodiment;

FIG. 5A is a block diagram of a system for predicting health of a link,in accordance with an illustrative embodiment;

FIG. 5B is a block diagram of a sequence of operations for predictinghealth of a link, in accordance with an illustrative embodiment; and

FIG. 5C is a flow diagram of method of predicting health of a link, inaccordance with an illustrative embodiment.

DETAILED DESCRIPTION

For purposes of reading the description of the various embodimentsbelow, the following descriptions of the sections of the specificationand their respective contents can be helpful:

Section A describes a network environment and computing environmentwhich can be useful for practicing embodiments described herein;

Section B describes embodiments of systems and methods for delivering acomputing environment to a remote user;

Section C describes embodiments of systems and methods for virtualizingan application delivery controller;

Section D describes embodiments of systems and methods for providing aclustered appliance architecture environment; and

Section E describes embodiments of systems and methods for predictinghealth of a link.

A. Network and Computing Environment

Referring to FIG. 1A, an illustrative network environment 100 isdepicted. Network environment 100 can include one or more clients102(1)-102(n) (also generally referred to as local machine(s) 102 orclient(s) 102) in communication with one or more servers 106(1)-106(n)(also generally referred to as remote machine(s) 106 or server(s) 106)via one or more networks 104(1)-104 n (generally referred to asnetwork(s) 104). In some embodiments, a client 102 can communicate witha server 106 via one or more appliances 200(1)-200 n (generally referredto as appliance(s) 200 or gateway(s) 200).

Although the embodiment shown in FIG. 1A shows one or more networks 104between clients 102 and servers 106, in other embodiments, clients 102and servers 106 can be on the same network 104. The various networks 104can be the same type of network or different types of networks. Forexample, in some embodiments, network 104(1) can be a private networksuch as a local area network (LAN) or a company Intranet, while network104(2) and/or network 104(n) can be a public network, such as a widearea network (WAN) or the Internet. In other embodiments, both network104(1) and network 104(n) can be private networks. Networks 104 canemploy one or more types of physical networks and/or network topologies,such as wired and/or wireless networks, and can employ one or morecommunication transport protocols, such as transmission control protocol(TCP), internet protocol (IP), user datagram protocol (UDP) or othersimilar protocols.

As shown in FIG. 1A, one or more appliances 200 can be located atvarious points or in various communication paths of network environment100. For example, appliance 200 can be deployed between two networks104(1) and 104(2), and appliances 200 can communicate with one anotherto work in conjunction to, for example, accelerate network trafficbetween clients 102 and servers 106. In other embodiments, the appliance200 can be located on a network 104. For example, appliance 200 can beimplemented as part of one of clients 102 and/or servers 106. In anembodiment, appliance 200 can be implemented as a network device such asNetScaler® products sold by Citrix Systems, Inc. of Fort Lauderdale,Fla.

As shown in FIG. 1A, one or more servers 106 can operate as a serverfarm 38. Servers 106 of server farm 38 can be logically grouped, and caneither be geographically co-located (e.g., on premises) orgeographically dispersed (e.g., cloud based) from clients 102 and/orother servers 106. In an embodiment, server farm 38 executes one or moreapplications on behalf of one or more of clients 102 (e.g., as anapplication server), although other uses are possible, such as a fileserver, gateway server, proxy server, or other similar server uses.Clients 102 can seek access to hosted applications on servers 106.

As shown in FIG. 1A, in some embodiments, appliances 200 can include, bereplaced by, or be in communication with, one or more additionalappliances, such as WAN solution appliances 205(1)-205(n), referred togenerally as WAN solution appliance(s) 205. WAN solution appliance caninclude, for example, a WAN virtualized solution or a WAN optimizer. Forexample, WAN solution appliance 205 can accelerate, cache, compress,manage or otherwise optimize or improve performance, operation, flowcontrol, or quality of service of network traffic, such as traffic toand/or from a WAN connection, such as optimizing Wide Area File Services(WAFS), accelerating Server Message Block (SMB) or Common Internet FileSystem (CIFS). In some embodiments, appliance 205 can be a performanceenhancing proxy or a WAN solution or optimization controller. In oneembodiment, appliance 205 can be implemented as CloudBridge® productssold by Citrix Systems, Inc. of Fort Lauderdale, Fla.

Referring to FIG. 1B, an example network environment, 100′, fordelivering and/or operating a computing network environment on a client102 is shown. As shown in FIG. 1B, a server 106 can include anapplication delivery system 190 for delivering a computing environment,application, and/or data files to one or more clients 102. Client 102can include client agent 120 and computing environment 15. Computingenvironment 15 can execute or operate an application 16 that accesses,processes or uses a data file 17. Computing environment 15, application16 and/or data file 17 can be delivered via appliance 200 and/or theserver 106.

Appliance 200 can accelerate delivery of all or a portion of computingenvironment 15 to a client 102, for example by the application deliverysystem 190. For example, appliance 200 can accelerate delivery of astreaming application and data file processable by the application froma data center to a remote user location by accelerating transport layertraffic between a client 102 and a server 106. Such acceleration can beprovided by one or more techniques, such as: 1) transport layerconnection pooling, 2) transport layer connection multiplexing, 3)transport control protocol buffering, 4) compression, 5) caching, orother techniques. Appliance 200 can also provide load balancing ofservers 106 to process requests from clients 102, act as a proxy oraccess server to provide access to the one or more servers 106, providesecurity and/or act as a firewall between a client 102 and a server 106,provide Domain Name Service (DNS) resolution, provide one or morevirtual servers or virtual internet protocol servers, and/or provide asecure virtual private network (VPN) connection from a client 102 to aserver 106, such as a secure socket layer (SSL) VPN connection and/orprovide encryption and decryption operations.

Application delivery management system 190 can deliver computingenvironment 15 to a user (e.g., client 102), remote or otherwise, basedon authentication and authorization policies applied by policy engine195. A remote user can obtain a computing environment and access toserver stored applications and data files from any network-connecteddevice (e.g., client 102). For example, appliance 200 can request anapplication and data file from server 106. In response to the request,application delivery system 190 and/or server 106 can deliver theapplication and data file to client 102, for example via an applicationstream to operate in computing environment 15 on client 102, or via aremote-display protocol or otherwise via remote-based or server-basedcomputing. In an embodiment, application delivery system 190 can beimplemented as any portion of the Citrix Workspace Suite™ by CitrixSystems, Inc., such as XenApp® or XenDesktop®.

Policy engine 195 can control and manage the access to, and executionand delivery of, applications. For example, policy engine 195 candetermine the one or more applications a user or client 102 can accessand/or how the application should be delivered to the user or client102, such as a server-based computing, streaming or delivering theapplication locally to the client 120 for local execution.

For example, in operation, a client 102 can request execution of anapplication (e.g., application 16′) and application delivery system 190of server 106 determines how to execute application 16′, for examplebased upon credentials received from client 102 and a user policyapplied by policy engine 195 associated with the credentials. Forexample, application delivery system 190 can enable client 102 toreceive application-output data generated by execution of theapplication on a server 106, can enable client 102 to execute theapplication locally after receiving the application from server 106, orcan stream the application via network 104 to client 102. For example,in some embodiments, the application can be a server-based or aremote-based application executed on server 106 on behalf of client 102.Server 106 can display output to client 102 using a thin-client orremote-display protocol, such as the Independent Computing Architecture(ICA) protocol by Citrix Systems, Inc. of Fort Lauderdale, Fla. Theapplication can be any application related to real-time datacommunications, such as applications for streaming graphics, streamingvideo and/or audio or other data, delivery of remote desktops orworkspaces or hosted services or applications, for exampleinfrastructure as a service (IaaS), workspace as a service (WaaS),software as a service (SaaS) or platform as a service (PaaS).

One or more of servers 106 can include a performance monitoring serviceor agent 197. In some embodiments, a dedicated one or more servers 106can be employed to perform performance monitoring. Performancemonitoring can be performed using data collection, aggregation,analysis, management and reporting, for example by software, hardware ora combination thereof. Performance monitoring can include one or moreagents for performing monitoring, measurement and data collectionactivities on clients 102 (e.g., client agent 120), servers 106 (e.g.,agent 197) or an appliances 200 and/or 205 (agent not shown). Ingeneral, monitoring agents (e.g., 120 and/or 197) execute transparently(e.g., in the background) to any application and/or user of the device.In some embodiments, monitoring agent 197 includes any of the productembodiments referred to as EdgeSight by Citrix Systems, Inc. of FortLauderdale, Fla.

The monitoring agents can monitor, measure, collect, and/or analyze dataon a predetermined frequency, based upon an occurrence of givenevent(s), or in real time during operation of network environment 100.The monitoring agents can monitor resource consumption and/orperformance of hardware, software, and/or communications resources ofclients 102, networks 104, appliances 200 and/or 205, and/or servers106. For example, network connections such as a transport layerconnection, network latency, bandwidth utilization, end-user responsetimes, application usage and performance, session connections to anapplication, cache usage, memory usage, processor usage, storage usage,database transactions, client and/or server utilization, active users,duration of user activity, application crashes, errors, or hangs, thetime required to log-in to an application, a server, or the applicationdelivery system, and/or other performance conditions and metrics can bemonitored.

The monitoring agents can provide application performance management forapplication delivery system 190. For example, based upon one or moremonitored performance conditions or metrics, application delivery system190 can be dynamically adjusted, for example periodically or inreal-time, to optimize application delivery by servers 106 to clients102 based upon network environment performance and conditions.

In described embodiments, clients 102, servers 106, and appliances 200and 205 can be deployed as and/or executed on any type and form ofcomputing device, such as any desktop computer, laptop computer, ormobile device capable of communication over at least one network andperforming the operations described herein. For example, clients 102,servers 106 and/or appliances 200 and 205 can each correspond to onecomputer, a plurality of computers, or a network of distributedcomputers such as computer 101 shown in FIG. 1C.

As shown in FIG. 1C, computer 101 can include one or more processors103, volatile memory 122 (e.g., RAM), non-volatile memory 128 (e.g., oneor more hard disk drives (HDDs) or other magnetic or optical storagemedia, one or more solid state drives (SSDs) such as a flash drive orother solid state storage media, one or more hybrid magnetic and solidstate drives, and/or one or more virtual storage volumes, such as acloud storage, or a combination of such physical storage volumes andvirtual storage volumes or arrays thereof), user interface (UI) 123, oneor more communications interfaces 118, and communication bus 150. Userinterface 123 can include graphical user interface (GUI) 124 (e.g., atouchscreen, a display, etc.) and one or more input/output (I/O) devices126 (e.g., a mouse, a keyboard, etc.). Non-volatile memory 128 storesoperating system 115, one or more applications 116, and data 117 suchthat, for example, computer instructions of operating system 115 and/orapplications 116 are executed by processor(s) 103 out of volatile memory122. Data can be entered using an input device of GUI 124 or receivedfrom I/O device(s) 126. Various elements of computer 101 can communicatevia communication bus 150. Computer 101 as shown in FIG. 1C is shownmerely as an example, as clients 102, servers 106 and/or appliances 200and 205 can be implemented by any computing or processing environmentand with any type of machine or set of machines that can have suitablehardware and/or software capable of operating as described herein.

Processor(s) 103 can be implemented by one or more programmableprocessors executing one or more computer programs to perform thefunctions of the system. As used herein, the term “processor” describesan electronic circuit that performs a function, an operation, or asequence of operations. The function, operation, or sequence ofoperations can be hard coded into the electronic circuit or soft codedby way of instructions held in a memory device. A “processor” canperform the function, operation, or sequence of operations using digitalvalues or using analog signals. In some embodiments, the “processor” canbe embodied in one or more application specific integrated circuits(ASICs), microprocessors, digital signal processors, microcontrollers,field programmable gate arrays (FPGAs), programmable logic arrays(PLAs), multi-core processors, or general-purpose computers withassociated memory. The “processor” can be analog, digital ormixed-signal. In some embodiments, the “processor” can be one or morephysical processors or one or more “virtual” (e.g., remotely located or“cloud”) processors.

Communications interfaces 118 can include one or more interfaces toenable computer 101 to access a computer network such as a LAN, a WAN,or the Internet through a variety of wired and/or wireless or cellularconnections.

In described embodiments, a first computing device 101 can execute anapplication on behalf of a user of a client computing device (e.g., aclient 102), can execute a virtual machine, which provides an executionsession within which applications execute on behalf of a user or aclient computing device (e.g., a client 102), such as a hosted desktopsession, can execute a terminal services session to provide a hosteddesktop environment, or can provide access to a computing environmentincluding one or more of: one or more applications, one or more desktopapplications, and one or more desktop sessions in which one or moreapplications can execute.

Additional details of the implementation and operation of networkenvironment 100, clients 102, servers 106, and appliances 200 and 205can be as described in U.S. Pat. No. 9,538,345, issued Jan. 3, 2017 toCitrix Systems, Inc. of Fort Lauderdale, Fla., the teachings of whichare hereby incorporated herein by reference.

B. Appliance Architecture

FIG. 2 shows an example embodiment of appliance 200. As describedherein, appliance 200 can be implemented as a server, gateway, router,switch, bridge or other type of computing or network device. As shown inFIG. 2, an embodiment of appliance 200 can include a hardware layer 206and a software layer 205 divided into a user space 202 and a kernelspace 204. Hardware layer 206 provides the hardware elements upon whichprograms and services within kernel space 204 and user space 202 areexecuted and allow programs and services within kernel space 204 anduser space 202 to communicate data both internally and externally withrespect to appliance 200. As shown in FIG. 2, hardware layer 206 caninclude one or more processing units 262 for executing software programsand services, memory 264 for storing software and data, network ports266 for transmitting and receiving data over a network, and encryptionprocessor 260 for encrypting and decrypting data such as in relation toSecure Socket Layer (SSL) or Transport Layer Security (TLS) processingof data transmitted and received over the network.

An operating system of appliance 200 allocates, manages, or otherwisesegregates the available system memory into kernel space 204 and userspace 202. Kernel space 204 is reserved for running kernel 230,including any device drivers, kernel extensions or other kernel relatedsoftware. As known to those skilled in the art, kernel 230 is the coreof the operating system, and provides access, control, and management ofresources and hardware-related elements of application 104. Kernel space204 can also include a number of network services or processes workingin conjunction with cache manager 232.

Appliance 200 can include one or more network stacks 267, such as aTCP/IP based stack, for communicating with client(s) 102, server(s) 106,network(s) 104, and/or other appliances 200 or 205. For example,appliance 200 can establish and/or terminate one or more transport layerconnections between clients 102 and servers 106. Each network stack 267can include a buffer 243 for queuing one or more network packets fortransmission by appliance 200.

Kernel space 204 can include cache manager 232, packet engine 240,encryption engine 234, policy engine 236 and compression engine 238. Inother words, one or more of processes 232, 240, 234, 236 and 238 run inthe core address space of the operating system of appliance 200, whichcan reduce the number of data transactions to and from the memory and/orcontext switches between kernel mode and user mode, for example sincedata obtained in kernel mode may not need to be passed or copied to auser process, thread or user level data structure.

Cache manager 232 can duplicate original data stored elsewhere or datapreviously computed, generated or transmitted to reducing the accesstime of the data. In some embodiments, the cache memory can be a dataobject in memory 264 of appliance 200, or can be a physical memoryhaving a faster access time than memory 264.

Policy engine 236 can include a statistical engine or otherconfiguration mechanism to allow a user to identify, specify, define orconfigure a caching policy and access, control and management ofobjects, data or content being cached by appliance 200, and define orconfigure security, network traffic, network access, compression orother functions performed by appliance 200.

Encryption engine 234 can process any security related protocol, such asSSL or TLS. For example, encryption engine 234 can encrypt and decryptnetwork packets, or any portion thereof, communicated via appliance 200,can setup or establish SSL, TLS or other secure connections, for examplebetween client 102, server 106, and/or other appliances 200 or 205. Insome embodiments, encryption engine 234 can use a tunneling protocol toprovide a VPN between a client 102 and a server 106. In someembodiments, encryption engine 234 is in communication with encryptionprocessor 260. Compression engine 238 compresses network packetsbi-directionally between clients 102 and servers 106 and/or between oneor more appliances 200.

Packet engine 240 can manage kernel-level processing of packets receivedand transmitted by appliance 200 via network stacks 267 to send andreceive network packets via network ports 266. Packet engine 240 canoperate in conjunction with encryption engine 234, cache manager 232,policy engine 236 and compression engine 238, for example to performencryption/decryption, traffic management such as request-level contentswitching and request-level cache redirection, and compression anddecompression of data.

User space 202 is a memory area or portion of the operating system usedby user mode applications or programs otherwise running in user mode. Auser mode application may not access kernel space 204 directly and usesservice calls in order to access kernel services. User space 202 caninclude graphical user interface (GUI) 210, a command line interface(CLI) 212, shell services 214, health monitor 216, and daemon services218. GUI 210 and CLI 212 enable a system administrator or other user tointeract with and control the operation of appliance 200, such as viathe operating system of appliance 200. Shell services 214 include theprograms, services, tasks, processes or executable instructions tosupport interaction with appliance 200 by a user via the GUI 210 and/orCLI 212.

Health monitor 216 monitors, checks, reports and ensures that networksystems are functioning properly and that users are receiving requestedcontent over a network, for example by monitoring activity of appliance200. In some embodiments, health monitor 216 intercepts and inspects anynetwork traffic passed via appliance 200. For example, health monitor216 can interface with one or more of encryption engine 234, cachemanager 232, policy engine 236, compression engine 238, packet engine240, daemon services 218, and shell services 214 to determine a state,status, operating condition, or health of any portion of the appliance200. Further, health monitor 216 can determine if a program, process,service or task is active and currently running, check status, error orhistory logs provided by any program, process, service or task todetermine any condition, status or error with any portion of appliance200. Additionally, health monitor 216 can measure and monitor theperformance of any application, program, process, service, task orthread executing on appliance 200.

Daemon services 218 are programs that run continuously or in thebackground and handle periodic service requests received by appliance200. In some embodiments, a daemon service can forward the requests toother programs or processes, such as another daemon service 218 asappropriate.

As described herein, appliance 200 can relieve servers 106 of much ofthe processing load caused by repeatedly opening and closing transportlayers connections to clients 102 by opening one or more transport layerconnections with each server 106 and maintaining these connections toallow repeated data accesses by clients via the Internet (e.g.,“connection pooling”). To perform connection pooling, appliance 200 cantranslate or multiplex communications by modifying sequence numbers andacknowledgment numbers at the transport layer protocol level (e.g.,“connection multiplexing”). Appliance 200 can also provide switching orload balancing for communications between the client 102 and server 106.

As described herein, each client 102 can include client agent 120 forestablishing and exchanging communications with appliance 200 and/orserver 106 via a network 104. Client 102 can have installed and/orexecute one or more applications that are in communication with network104. Client agent 120 can intercept network communications from anetwork stack used by the one or more applications. For example, clientagent 120 can intercept a network communication at any point in anetwork stack and redirect the network communication to a destinationdesired, managed or controlled by client agent 120, for example tointercept and redirect a transport layer connection to an IP address andport controlled or managed by client agent 120. Thus, client agent 120can transparently intercept any protocol layer below the transportlayer, such as the network layer, and any protocol layer above thetransport layer, such as the session, presentation or applicationlayers. Client agent 120 can interface with the transport layer tosecure, optimize, accelerate, route or load-balance any communicationsprovided via any protocol carried by the transport layer.

In some embodiments, client agent 120 is implemented as an IndependentComputing Architecture (ICA) client developed by Citrix Systems, Inc. ofFort Lauderdale, Fla. Client agent 120 can perform acceleration,streaming, monitoring, and/or other operations. For example, clientagent 120 can accelerate streaming an application from a server 106 to aclient 102. Client agent 120 can also perform end-pointdetection/scanning and collect end-point information about client 102for appliance 200 and/or server 106. Appliance 200 and/or server 106 canuse the collected information to determine and provide access,authentication and authorization control of the client's connection tonetwork 104. For example, client agent 120 can identify and determineone or more client-side attributes, such as: the operating system and/ora version of an operating system, a service pack of the operatingsystem, a running service, a running process, a file, presence orversions of various applications of the client, such as antivirus,firewall, security, and/or other software.

Additional details of the implementation and operation of appliance 200can be as described in U.S. Pat. No. 9,538,345, issued Jan. 3, 2017 toCitrix Systems, Inc. of Fort Lauderdale, Fla., the teachings of whichare hereby incorporated herein by reference.

C. Systems and Methods for Providing Virtualized Application DeliveryController

Referring now to FIG. 3, a block diagram of a virtualized environment300 is shown. As shown, a computing device 302 in virtualizedenvironment 300 includes a virtualization layer 303, a hypervisor layer304, and a hardware layer 307. Hypervisor layer 304 includes one or morehypervisors (or virtualization managers) 301 that allocates and managesaccess to a number of physical resources in hardware layer 307 (e.g.,physical processor(s) 321 and physical disk(s) 328) by at least onevirtual machine (VM) (e.g., one of VMs 306) executing in virtualizationlayer 303. Each VM 306 can include allocated virtual resources such asvirtual processors 332 and/or virtual disks 342, as well as virtualresources such as virtual memory and virtual network interfaces. In someembodiments, at least one of VMs 306 can include a control operatingsystem (e.g., 305) in communication with hypervisor 301 and used toexecute applications for managing and configuring other VMs (e.g., guestoperating systems 310) on device 302.

In general, hypervisor(s) 301 can provide virtual resources to anoperating system of VMs 306 in any manner that simulates the operatingsystem having access to a physical device. Thus, hypervisor(s) 301 canbe used to emulate virtual hardware, partition physical hardware,virtualize physical hardware, and execute virtual machines that provideaccess to computing environments. In an illustrative embodiment,hypervisor(s) 301 can be implemented as a XEN hypervisor, for example asprovided by the open source Xen.org community. In an illustrativeembodiment, device 302 executing a hypervisor that creates a virtualmachine platform on which guest operating systems can execute isreferred to as a host server. In such an embodiment, device 302 can beimplemented as a XEN server as provided by Citrix Systems, Inc., of FortLauderdale, Fla.

Hypervisor 301 can create one or more VMs 306 in which an operatingsystem (e.g., control operating system 305 and/or guest operating system310) executes. For example, the hypervisor 301 loads a virtual machineimage to create VMs 306 to execute an operating system. Hypervisor 301can present VMs 306 with an abstraction of hardware layer 307, and/orcan control how physical capabilities of hardware layer 307 arepresented to VMs 306. For example, hypervisor(s) 301 can manage a poolof resources distributed across multiple physical computing devices.

In some embodiments, one of VMs 306 (e.g., the VM executing controloperating system 305) can manage and configure other of VMs 306, forexample by managing the execution and/or termination of a VM and/ormanaging allocation of virtual resources to a VM. In variousembodiments, VMs can communicate with hypervisor(s) 301 and/or other VMsvia, for example, one or more Application Programming Interfaces (APIs),shared memory, and/or other techniques.

In general, VMs 306 can provide a user of device 302 with access toresources within virtualized computing environment 300, for example, oneor more programs, applications, documents, files, desktop and/orcomputing environments, or other resources. In some embodiments, VMs 306can be implemented as fully virtualized VMs that are not aware that theyare virtual machines (e.g., a Hardware Virtual Machine or HVM). In otherembodiments, the VM can be aware that it is a virtual machine, and/orthe VM can be implemented as a paravirtualized (PV) VM.

Although shown in FIG. 3 as including a single virtualized device 302,virtualized environment 300 can include a plurality of networked devicesin a system in which at least one physical host executes a virtualmachine. A device on which a VM executes can be referred to as aphysical host and/or a host machine. For example, appliance 200 can beadditionally or alternatively implemented in a virtualized environment300 on any computing device, such as a client 102, server 106 orappliance 200. Virtual appliances can provide functionality foravailability, performance, health monitoring, caching and compression,connection multiplexing and pooling and/or security processing (e.g.,firewall, VPN, encryption/decryption, etc.), similarly as described inregard to appliance 200.

Additional details of the implementation and operation of virtualizedcomputing environment 300 can be as described in U.S. Pat. No.9,538,345, issued Jan. 3, 2017 to Citrix Systems, Inc. of FortLauderdale, Fla., the teachings of which are hereby incorporated hereinby reference.

In some embodiments, a server can execute multiple virtual machines 306,for example on various cores of a multi-core processing system and/orvarious processors of a multiple processor device. For example, althoughgenerally shown herein as “processors” (e.g., in FIGS. 1C, 2 and 3), oneor more of the processors can be implemented as either single- ormulti-core processors to provide a multi-threaded, parallel architectureand/or multi-core architecture. Each processor and/or core can have oruse memory that is allocated or assigned for private or local use thatis only accessible by that processor/core, and/or can have or use memorythat is public or shared and accessible by multiple processors/cores.Such architectures can allow work, task, load or network trafficdistribution across one or more processors and/or one or more cores(e.g., by functional parallelism, data parallelism, flow-based dataparallelism, etc.).

Further, instead of (or in addition to) the functionality of the coresbeing implemented in the form of a physical processor/core, suchfunctionality can be implemented in a virtualized environment (e.g.,300) on a client 102, server 106 or appliance 200, such that thefunctionality can be implemented across multiple devices, such as acluster of computing devices, a server farm or network of computingdevices, etc. The various processors/cores can interface or communicatewith each other using a variety of interface techniques, such as core tocore messaging, shared memory, kernel APIs, etc.

In embodiments employing multiple processors and/or multiple processorcores, described embodiments can distribute data packets among cores orprocessors, for example to balance the flows across the cores. Forexample, packet distribution can be based upon determinations offunctions performed by each core, source and destination addresses,and/or whether: a load on the associated core is above a predeterminedthreshold; the load on the associated core is below a predeterminedthreshold; the load on the associated core is less than the load on theother cores; or any other metric that can be used to determine where toforward data packets based in part on the amount of load on a processor.

For example, data packets can be distributed among cores or processesusing receive-side scaling (RSS) in order to process packets usingmultiple processors/cores in a network. RSS generally allows packetprocessing to be balanced across multiple processors/cores whilemaintaining in-order delivery of the packets. In some embodiments, RSScan use a hashing scheme to determine a core or processor for processinga packet.

The RSS can generate hashes from any type and form of input, such as asequence of values. This sequence of values can include any portion ofthe network packet, such as any header, field or payload of networkpacket, and include any tuples of information associated with a networkpacket or data flow, such as addresses and ports. The hash result or anyportion thereof can be used to identify a processor, core, engine, etc.,for distributing a network packet, for example via a hash table,indirection table, or other mapping technique.

Additional details of the implementation and operation of amulti-processor and/or multi-core system can be as described in U.S.Pat. No. 9,538,345, issued Jan. 3, 2017 to Citrix Systems, Inc. of FortLauderdale, Fla., the teachings of which are hereby incorporated hereinby reference.

D. Systems and Methods for Providing a Distributed Cluster Architecture

Although shown in FIGS. 1A and 1B as being single appliances, appliances200 can be implemented as one or more distributed or clusteredappliances. Individual computing devices or appliances can be referredto as nodes of the cluster. A centralized management system can performload balancing, distribution, configuration, or other tasks to allow thenodes to operate in conjunction as a single computing system. Such acluster can be viewed as a single virtual appliance or computing device.FIG. 4 shows a block diagram of an illustrative computing device clusteror appliance cluster 400. A plurality of appliances 200 or othercomputing devices (e.g., nodes) can be joined into a single cluster 400.Cluster 400 can operate as an application server, network storageserver, backup service, or any other type of computing device to performmany of the functions of appliances 200 and/or 205.

In some embodiments, each appliance 200 of cluster 400 can beimplemented as a multi-processor and/or multi-core appliance, asdescribed herein. Such embodiments can employ a two-tier distributionsystem, with one appliance if the cluster distributing packets to nodesof the cluster, and each node distributing packets for processing toprocessors/cores of the node. In many embodiments, one or more ofappliances 200 of cluster 400 can be physically grouped orgeographically proximate to one another, such as a group of bladeservers or rack mount devices in a given chassis, rack, and/or datacenter. In some embodiments, one or more of appliances 200 of cluster400 can be geographically distributed, with appliances 200 notphysically or geographically co-located. In such embodiments,geographically remote appliances can be joined by a dedicated networkconnection and/or VPN. In geographically distributed embodiments, loadbalancing can also account for communications latency betweengeographically remote appliances.

In some embodiments, cluster 400 can be considered a virtual appliance,grouped via common configuration, management, and purpose, rather thanas a physical group. For example, an appliance cluster can comprise aplurality of virtual machines or processes executed by one or moreservers.

As shown in FIG. 4, appliance cluster 400 can be coupled to a firstnetwork 104(1) via client data plane 402, for example to transfer databetween clients 102 and appliance cluster 400. Client data plane 402 canbe implemented a switch, hub, router, or other similar network deviceinternal or external to cluster 400 to distribute traffic across thenodes of cluster 400. For example, traffic distribution can be performedbased on equal-cost multi-path (ECMP) routing with next hops configuredwith appliances or nodes of the cluster, open-shortest path first(OSPF), stateless hash-based traffic distribution, link aggregation(LAG) protocols, or any other type and form of flow distribution, loadbalancing, and routing.

Appliance cluster 400 can be coupled to a second network 104(2) viaserver data plane 404. Similarly to client data plane 402, server dataplane 404 can be implemented as a switch, hub, router, or other networkdevice that can be internal or external to cluster 400. In someembodiments, client data plane 402 and server data plane 404 can bemerged or combined into a single device.

In some embodiments, each appliance 200 of cluster 400 can be connectedvia an internal communication network or backplane 406. Backplane 406can enable inter-node or inter-appliance control and configurationmessages, for inter-node forwarding of traffic, and/or for communicatingconfiguration and control traffic from an administrator or user tocluster 400. In some embodiments, backplane 406 can be a physicalnetwork, a VPN or tunnel, or a combination thereof.

Additional details of cluster 400 can be as described in U.S. Pat. No.9,538,345, issued Jan. 3, 2017 to Citrix Systems, Inc. of FortLauderdale, Fla., the teachings of which are hereby incorporated hereinby reference.

E. Systems and Methods for Predicting Health of a Link

The present disclosure is directed to systems and methods for predictinghealth of a link. In a network, it can be challenging to identify linksthat are in a good state, identify the cause of a link entering a badstate, predict the future state of a link, or proactively prevent a linkfrom entering a bad state. A device intermediary between a client and aserver, such as a network appliance or a middlebox, can facilitate orimprove load balancing of data transmission across links by utilizinglinks that are in a good state to transmit data. The device candetermine the best link to send the high priority packets (traffic) bydetermining the packet loss, latency, jitter, congestion and othernetwork entities from each of the links. For example, given a set oflinks between two middleboxes, network throughput or reliability can beimproved by load balancing the data across good links that experienceless packet drops, latency and jitter, as opposed to bad links. Anactive link (path) between the middleboxes can either be in a good stateor a bad state based on the loss, latency, and jitter. The middlebox canbe configured to choose a link or path that is in a good state asopposed to a link that is in a bad state (e.g., a link that experiencesmore packet loss, jitter and latency) to provide better QoS for theconnections. Thus, maintaining more links in a good state can providebetter quality of service (QoS) for the connections as it can providethe middlebox with more options from which to choose a link to sendpackets.

Factors that can cause a link to enter a bad state include, for example,high latency, high packet drop or high jitter. If the device candetermine the cause of the link entering the bad state, the device canrecover the link from that state. For example, if high jitter is thecause for a link from going bad, the device can remove the factors fromthe appliance end for that link that cause high jitter, therebypreventing the link from going to bad state.

Further, since the device selects good links to transport the packetsreliably, the device can increase the load on good links. This can causethe good links to experience high jitter and loss and, eventually, entera bad state. Systems and methods of the present disclosure can improvethe use of the links by avoiding this cascading effect by predicting acause of a link entering a bad state, and performing an action based onthe cause to prevent the link from entering the bad state, such asredistributing traffic of certain connections. The intermediary devicecan prevent the best links from entering a bad state, and maintain ahigher number of good quality links in the WAN.

Thus, systems and methods of the present disclosure allow a device todynamically predict link health and take action based on the link healthto prevent the link from going bad. Proactively managing link health orquality can prevent cascading effects of links going bad due tooverloading. Further, the device can maintain a greater number of linksin a good state.

To do so, the device can use predictive algorithms to detect a cause ofa link entering a bad state or, a cause of a link entering a bad statein the future, and take actions based on the predicted cause to preventthe link from entering the bad state or recovering the link from the badstate. Thus, the device can maintain a high number of good qualitylinks.

The device can identify, determine or predict the state (or health) of alink based on one or more parameters. The device can perform proactiveconnection management based on the parameters. For example, the devicecan be configured with a hybrid prediction mechanism that can include aset of static rules and an online machine learning classifier. Thestatic rules can be empirically composed of link health definingparameters. The online machine learning classifier can learn over theseparameters. The prediction output by the static rules and the predictionoutput by the online machine learning classifier can be weighted andcombined to generate a final prediction that indicates whether a link isentering a bad state, as well as the cause of the link entering the badstate. The device can perform a proactive action or decision based onthe cause in order to maintain the state or health of the link. Thedevice can apply weights to the predictions that can be a function oftime and accuracy of the respective tools.

To detect what causes a link to go to a bad state, the device canidentify one or more variables or parameters, such as high packet drop,high jitter or high latency. The device can determine that the link canenter a bad state if any one or more of these parameters is greater thana threshold. The device can predict that a link would experience one ormore of high packet drop, high jitter or high latency based on patternsand relationships. These patterns and relationships can be referred toas a feature set.

For example, an increase in packet drop can be determined from acombination of: increase in link utilization; increase in link latency;synchronization of window size; rate of increase of number ofconnections (burst); and type of connections (e.g., bulk, chatty, orstream). In another example, the increase in jitter can be determinedby: difference in inter-arrival time in the queue, and the inter-arrivaltime to send the packets from the queue; average queue size; and currentqueue size. In yet another example, the increase in packet drop can bedetermined by: queue size; minimum latency; type of connection; andnumber of connections. The device can leverage the relationships acrossthe various learning algorithms, by using prediction algorithms topredict what parameters can cause the link to fail (or enter a badstate) in the future.

A device (or appliance, WAN solution appliance, or intermediary device)can collect profile information or an online stream of traffic profileinformation. Static rules can predict the health of the link. Forexample:

C1*Loss+C2*Latency+C3*Jitter>T1=>Bad link; or

C4*Loss+C5*Latency+C6*Jitter>T2=>Average Link,

where C1, C2, C3, C4, C5, and C6 are weights; Loss, Latency and Jitterare parameters of the link; and T1 and T2 are thresholds.

In these example equations, even if one parameter, such as Loss, Latencyor Jitter is too high, then the device determines or predicts that thelink is or will be bad.

The system can also use an online machine learning classifier todetermine or predict that the link is or will be bad. The machinelearning classifier can use a training data set. For example, when thehealth of a link goes from good to bad due to loss, jitter, or latency,the timed sequence of parameters such as link utilization, latency,number of connections, queue size, etc., can be referred to as a singledata point. The data set can include multiple rows of this data toreflect the time dependency or temporal nature of changes in the linkhealth.

Initially, the pattern the classifier learns about different link stateclasses may be under fitted because the data set may be relativelysmall, and the classifier has a relatively few data points on which torely to predict link health. Since the prediction generated by theclassifier using relatively few data points may be different from theprediction generated by the static rules, the device can apply weightsto the two predictions. The device can generate weight variablesW_(class) and W_(rule). W_(class) can be the weight corresponding to theclassifier, and W_(rule) can be the weight corresponding to the staticrules. The device can use the weight variables break a tie between thepredictions provided by the static rules and the classifier. The devicecan adjust the weights by increasing a weight for a technique if thecorresponding prediction is correct (e.g., incentivize), or decreasingthe weight if the prediction is wrong (e.g., penalize). The followingpseudocode illustrates an implementation of applying the weight functionf(Pred, W):

If (WClass > WRule) { FinalPrediction = PredClass; } else {FinalPrediction = PredRule; }

Having predicted the cause of the link going bad, the device can takepreventive actions to prevent the link from entering a bad state. Forexample, if the predicted cause is high latency, the device can moveconnections with high packet occupancy in the queue to other links. Inanother example, if the predicted cause is high jitter, the device canmove connections whose difference in inter-arrival time into theappliance and inter-departure time out of the queue is very high. In yetanother example, if the predicted cause of the link going bad is highloss, the device can send only 90% of the bandwidth (e.g., for a 10 Mbpslink, the device may transmit only 9 Mbps).

Referring now to FIG. 5A, depicted is a block diagram of an embodimentof a system 500 for predicting health of a link. In brief summary, thesystem 500 can include a plurality of client devices 102 a-n, one ormore appliances 200 a-n (e.g., a first appliance 200 a and a secondappliance 200 b as shown), and a plurality of servers 106 a-n. Theclient-side facing appliances 200 a-n (e.g., the first appliance 200 a)can be communicatively connected to the one or more clients 102 a-n vianetwork 104. The server-side appliances 200 a-n (e.g., the secondappliance 200 b) can be communicatively connected to the one or moreservers 106 a-n via network 104″. The client-side facing appliances 200a-n (e.g., the first appliance 200 a) and the server-side facingappliances 200 a-n (e.g., the second appliance 200 b) can becommunicatively connected to one another via network 104′. In someembodiments, there can be one or more communication links via thenetwork 104′ connecting the client-side facing appliances 200 a-n (e.g.,the first appliance 200 a) and the server-side facing appliances 200 a-n(e.g., the second appliance 200 b). The networks 104 and 104″ can belocal area networks (LAN), whereas the network 104′ can be a wide areanetwork (WAN) for example.

Each appliance 200 a-n can comprise features of any embodiment of thedevices 200, described above in connection with at least FIGS. 1A-1C, 2,and 4. Each of the above-mentioned elements or entities is implementedin hardware, or a combination of hardware and software, in one or moreembodiments. For instance, each of these elements or entities caninclude any application, program, library, script, task, service,process or any type and form of executable instructions executing onhardware of the device 200. The hardware includes circuitry such as oneor more processors in one or more embodiments.

The systems and methods of the present solution can be implemented inany type and form of device, including clients, servers and appliances200. As referenced herein, a “server” can sometimes refer to any devicein a client-server relationship, e.g., an appliance 200 in a handshakewith a client device 102 a-n. The present systems and methods can beimplemented in any intermediary device or gateway, such as anyembodiments of the appliance or devices 200 described herein. Someportion of the present systems and methods can be implemented as part ofa packet processing engine and/or virtual server of an appliance, forinstance. The systems and methods can be implemented in any type andform of environment, including multi-core appliances, virtualizedenvironments and/or clustered environments described herein.

The first appliance 200 a can include a rule engine 502 a, a classifier504 a, a weight adjuster 506 a, a prediction selector 508 a, and aprofile 510 a. The second appliance 200 b also can include a rule engine502 b, a classifier 504 b, a weight adjuster 506 b, a predictionselector 508 b, and a profile 510 b. The rule engine 502 a of the firstappliance 200 a can include similar functionalities as the rule engine502 b of the second appliance 200 b. The classifier 504 a of the firstappliance 200 a can include similar functionalities as the classifier504 b of the second appliance 200 b. The weight adjuster 506 a of thefirst appliance 200 a can include similar functionalities as the weightadjuster 506 b of the second appliance 200 b. The prediction selector508 a of the first appliance 200 a can include similar functionalitiesas the prediction selector 508 b of the second appliance 200 b. Theprofile 510 a of the first appliance 200 a can include similar data orfunctionalities as the profile 510 b of the second appliance. Forexample, the profile 510 a can be in synchronization with the profile510 b.

Each of the one or more appliances 200 a-n can include one or more of atleast one rule engine, at least one classifier, at least one weightadjuster, at least one prediction selector or at least one profile, withsimilar functionalities as the first appliance 200 a and the secondappliance 200 b. The first appliance 200 a can be referred to as adevice or intermediary device.

The device (e.g., appliance 200 a or appliance 200 b) can be incommunication with one or more links traversing network 104′. The linkscan be formed of one or more paths through network 104′. For example,network 104′ can include a wide area network (WAN). A WAN can include atelecommunications network or computer network that extends over ageographical distance. The WAN can transmit data over relatively longdistances, and between different local area networks, personal areanetworks, or metropolitan area networks, for example. In some cases, theWAN can be configured as a public network or a private network, such asfor a particular organization.

The device can identify, obtain, retrieve, detector or otherwise obtainprofile information of a stream of network traffic traversing a link innetwork 104′. The link can refer to or include a network path betweentwo endpoints, nodes, a network tunnel, or a virtual private networktunnel. Network 104′ can include diverse types of links, including, forexample, one or more multiprotocol label switching links (MPLS),broadband links, and wireless links. For example, MPLS links can directdata from one network to the next based on short path labels. The labelscan identify virtual links (paths) between distant nodes. MPLS canencapsulate packets of various network protocols.

The profile information can include one or parameters about the link,such as latency, utilization, loss of packets, jitter, queue size,number of connections, and type of connection. In some cases, theprofile information can include two or more parameters about the link.Latency can refer to network latency and can refer to the amount of timeit takes for a packet of data to get from one designated point toanother. Latency can be measured by sending a packet that is returned tothe sender, where the round-trip time is referred to as the latency. Insome cases, the designated points can be appliance 200 a and appliance200 b. For example, the appliance 200 a can measure the time it takesfor the packet to travel from appliance 200 a to appliance 200 b andback to appliance 200 a via a link through network 104′. Latency can bemeasured in units of time, such as hours, minutes, seconds,microseconds, nanoseconds, or clock periods. A link can be labeled ashaving low latency or high latency based on a comparison of the latencywith a predetermined latency threshold.

Utilization, or network utilization, can refer to the ratio of currentnetwork traffic over a link to the maximum traffic that the link canhandle. The network utilization can be labeled as low, normal, or highbased on a comparison with predetermined utilization thresholds. Forexample, a network utilization of 90% can indicate high utilization ascompared to a network utilization of 20%. The appliance 200 a canidentify, detector or obtain the utilization of a link using a networkutilization monitor. For example, the appliance 200 a can be configuredwith or access a network monitor that collects network utilizationmetrics and statistics.

Loss of packets can refer to when one or more packets of data travelingacross the link fail to reach the predetermined destination. Packet losscan be measured as a percentage of packets lost with respect to packetssent. The appliance 200 a can detect or identify packet loss using theTCP protocol, which can detect packet loss over the link.

Jitter can refer to the variation in delay of received packets. Thevariation can be a statistical dispersion in the delay of the packets.For example, the sending side can transmit packets in a continuous,periodic stream where the packets are spaced apart evenly. However, dueto network congestion, improper queuing, or configuration errors, thedelay between packets can vary instead of remaining constant. In somecases, jitter can refer to the variation in latency as measured in thevariability over time of the packet latency across a link in network104′. For example, a link in network 104′ with constant latency may haveno variation (or jitter). Packet jitter can be expressed as an averageof the deviation from the network mean latency or packet delayvariation.

The queue size can refer to the amount of data maintained in a queue inthe appliance 200 a. The data can be maintained in a queue for a linkprior to transmission over the link in network 104′. The size of thequeue can be expressed in bytes, as a percentage of the original size ofthe data, or a proportion of the original size of the data to be sentover the link. In some embodiments, the data maintained in the queue caninclude data to be moved to the one or more links for transferring orprocessing between the one or more clients 102 a-n and the one or moreservers 106 a-n. The one or more links for transferring or processingbetween the one or more clients 102 a-n and the one or more servers 106a-n can be through two or more appliances 200 a-n. In some embodiments,the one or more links for transferring or processing between the one ormore clients 102 a-n and the one or more servers 106 a-n can be throughthe network 104′ connecting the two or more appliances 200 a-n.

The number of connections can refer to the number of connections overthe link in network 104′. Types of connections can include, for example,MPLS, broadband, wireless, virtual private network tunnel, secure link,encrypted link, type of protocol, frame size, etc.

The appliance 200 a can store the identified profile information in adata repository, database, data file, or data structure, such as inprofile 510 a, for further processing by one or more of appliance 200 aor appliance 200 b. The appliance 200 a can store the profileinformation for each of the one or more links in network 104′. Theappliance 200 a can store the profile information in one or more datastructures such that the profile information corresponds to a link and atime interval. The profile 510 a can store historical profileinformation for the one or more links, or can reset the stored profileinformation responsive to a time interval (e.g., 1 hour, 6 hours, 24hours, 48 hours, 72 hours, 1 week, 2 weeks, 30 days, etc.) or resetinstruction.

The appliance 200 a can include a rule engine 502 a that can apply oneor more rules to the parameters of the profile information for the linkto predict, determine, detector or estimate a health, status or qualityof the link. The rules can include static rules that can be applied tothe one or more parameters about the link. The rule engine 502 a canapply one or more rules to one or more parameters, two or moreparameters, three or more parameters or all available parameters aboutthe link. The rule engine 502 a can select a rule from a plurality ofrules based on the one or more parameters to which the rule engine 502 ais to apply the rule.

The rule engine 502 a can access a data repository, database or datafile storing rules. The rule engine 502 a can be configured with afunction, script, or executable file that can apply a rule to one ormore parameters. Applying the rule can include applying a weight,constant, or multiplier to one or more parameters, combining the one ormore parameters, and comparing the combined one or more parameters witha threshold.

In some embodiments, the rule engine 502 a can utilize a rule, equationor function configured such that even if one parameter is high, then thelink becomes bad. The following are illustrative examples of rules therule engine 502 a can apply to one or more parameters to determine thehealth of a link and make a first prediction of the health of the link:

Loss+Latency+Jitter>T ₁=>Bad link  Rule 1:

C1*Loss+C2*Latency+C3*Jitter>T ₁=>Bad link  Rule 2:

Loss+Latency+Jitter<T ₂=>Good link  Rule 3:

C4*Loss+C5*Latency+C6*Jitter>T ₂=>Average link  Rule 4:

In the example Rule 1, the rule engine 502 a combines the followingparameters Loss, Latency, and Jitter for the link by summing theparameters, and predicts that the health of the link is bad responsiveto the sum of the parameters being greater than the threshold T1.

The rule engine 502 a can combine the parameters by summing or addingthe parameters. The rule engine 502 a can combine the parameters bymultiplying the parameters. The rule engine 502 a can combine theparameters by taking a dot product of the parameters. The rule engine520 a can combine the parameters using one or more operations, such asaddition, subtraction, multiplication or division. Combining theparameters can include or refer to combining values for the parameters.For example, the value for the parameter Loss can be a percentage ofpackets lost with respect to packets sent (e.g., 1%, 2%, 3%, 5%, etc.),and the value for the parameter latency can be a unit of time (e.g., 1millisecond, 2 milliseconds, 3 milliseconds, 4 milliseconds, etc.).

The rule engine 502 a can compare the combination of the parameters(e.g., the sum of the parameters) with a threshold. The rule engine 502a can predict the health of the link based on the comparison of thecombination of the parameters with the threshold. The rule engine 502 acan identify, retrieve, receive or otherwise obtain the threshold from adata repository, database, data file or data structure stored in memoryon the appliance 200 a or otherwise accessible to the rule engine 502 a.The thresholds can be predetermined. The thresholds can be determinedbased on an analysis of historical link performance.

For example, the rule engine 502 a can retrieve a threshold T1 frommemory. The rule engine 502 a can compare the combination of theparameters with the threshold T1 to determine that the combination ofthe parameters is greater than T1, equal to T1, or less than T1. If thecombination of the parameters is greater than T1, the rule engine 502 acan determine or predict that the health of the link is bad, or that thelink is a bad link.

In the example Rule 2, the rule engine 502 a combines or applies amultiplier, weight, or constant to each of the parameters. The ruleengine 520 a compares the combined and weighted parameters withthreshold T1 to determine that the combined and weighted parameters isgreater than the threshold T1. Responsive to determining that thecombined and weighted parameters is greater than threshold T1, the ruleengine 502 a determines or predicts that the health of the link is bad.

For example, the rule engine 502 a can apply a multiplier or weight ofC1 to the Loss parameter; a multiplier or weight of C2 to the parameterLatency; and a multiplier or weight of C3 to the parameter of Jitter.The values for the multipliers C1, C2, C3 can be different or the same.The values for the multipliers C1, C2 and C3 can be predetermined. Thevalues for the multipliers C1, C2, and C3 can be configured to allow therule engine 502 a to combine the parameters such that the rule engine502 a can properly compare the combination with the threshold. Forexample, the multipliers C1, C2 and C3 can be selected or predeterminedto normalize the values for the one or more parameters, such as Loss,Latency and Jitter. The rule engine 502 a can combine the weights C1, C2and C3 with the corresponding one or more parameters via one or moreoperations, such as multiplication, dot product, division, addition, orsubtraction.

In the example Rule 3, the rule engine 502 a combines each of theparameters Loss, Latency and Jitter. The rule engine 520 a compares thecombined parameters with threshold T₂ to determine that the combinationof the parameters is less than the threshold T₂. For example, the ruleengine 502 a can combine the parameters via one or more operations, suchas multiplication, dot product, division, addition, or subtraction.Responsive to determining that the combination of the parameters is lessthan threshold T₂, the rule engine 502 a determines or predicts that thehealth of the link is good. The rule engine 502 a can flag the link ashaving a good health, assign a label to the link, associate the linkwith a good state in a data structure, or otherwise indicate or store,in a data file memory, the health of the link.

In the example Rule 4, the rule engine 502 a combines or applies amultiplier, weight, or constant to each of the parameters. The ruleengine 520 a compares the combined and weighted parameters withthreshold T2 to determine that the combined and weighted parameters isgreater than the threshold T2. Responsive to determining that thecombined and weighted parameters is greater than threshold T2, the ruleengine 502 a determines or predicts that the health of the link isaverage. The rule engine 502 a can flag the link as having averagehealth, assign a label to the link, associate the link with a good statein a data structure, or otherwise indicate or store, in a data filememory, the health of the link.

For example, the rule engine 502 a can apply a multiplier or weight ofC4 to the Loss parameter; a multiplier or weight of C5 to the parameterLatency; and a multiplier or weight of C6 to the parameter of Jitter.The values for the multipliers C4, C5, and C6 can be different or thesame. The values for the multipliers C4, C5, and C6 can bepredetermined. The values for the multipliers C4, C5, and C6 can beconfigured to allow the rule engine 502 a to combine the parameters suchthat the rule engine 502 a can properly compare the combination with thethreshold. For example, the multipliers C4, C5, and C6 can be selectedor predetermined to normalize the values for the one or more parameters,such as Loss, Latency and Jitter. The rule engine 502 a can combine theweights C4, C5, and C6 with the corresponding one or more parameters viaone or more operations, such as multiplication, dot product, division,addition, or subtraction.

The thresholds T1 and T2 can be dynamically set or determined based onany number of factors, such as a number of links, number of ports,bandwidth, historical values, information about the one or more clients102 a-n, the one or more servers 106 a-n, or other appliances 200 b-n,computing resources on the appliance 200 a (e.g., processor usage,processing time, memory usage, power consumption, etc.), and/or networkresources (e.g., bandwidth, latency, throughput, and other parametersresources at the networks 104, 104′, and 104″), priority of traffic,type of packets, etc.

The appliance 200 a can include a classifier 504 a. The classifier 504 acan determine a second prediction of health of the link by applying aclassifier to one or more timed sequences of the plurality of parametersof the profile information. The rule engine 502 a can make a firstprediction of the health of the link using a first technique, and theclassifier 504 a can make a second prediction of the link using a secondtechnique. For example, the rule engine 502 a can make a firstprediction of the health of the link using one or more static rules, andthe classifier 504 a can make a second prediction of the link using amachine learning technique.

The classifier 504 a can obtain one or more timed sequences of theparameters about the link. In some cases, the appliance 200 a can createthe one or more timed sequences of the plurality of parameters. Forexample, the appliance 200 a can monitor track the health of the linkbased on one or more parameters. As the combination of the one or moreparameters goes above or below a predetermined threshold, the classifier504 a can determine that the health of the link is good, bad, oraverage. For example, responsive to the health of the link one ofclimbing above or falling below a predetermined threshold, theclassifier 504 a can create the one or more timed sequences of theparameters about the link. The timed sequence of parameters can includeparameters such as link utilization, link latency, number ofconnections, synchronized TCP connections, queue size, etc. When thelink goes from good to bad, the appliance 200 a can assign or determinea class that indicates a parameter that led to the link going from goodto bad, such as high loss, high jitter, or high loss and high jitter.The appliance 200 a can determine the cause as being high loss based ona value for the loss parameter being greater than a predetermined lossthreshold. The appliance can determine the cause of the link being badbased on the value of the jitter parameter being greater than apredetermined jitter threshold.

The classifier 504 a can be configured with machine learningclassification technique to determine or predict the health of the link,such as whether the link is or will be bad. The classifier 504 a canidentify to which of a set of classes, categories (or sub-populations) anew set of one or more observed parameters belongs, on the basis of atraining set of data containing observations (or instances) whosecategory membership is known. For example, the training set of data caninclude timed sequences of parameters that correspond to when the healthof a link goes from good to bad due to loss, jitter, or latency, thetimed sequence of parameters such as link utilization, latency, numberof connections, queue size, etc., can be referred to as a single datapoint. The data set can include multiple rows of this data to reflectthe time dependency or temporal nature of changes in the link health. Inthis example, the class, category or subpopulation can be high loss,high jitter, or high jitter and loss. The observed parameters can beclassified as high loss, for example, based on the parameterscorresponding to an amount of packet loss that is greater than apredetermined threshold.

Synchronized Link Link Number of TCP Queue Time Utilization Latencyconnections Connection Size . . . . . . Class 1 A1 B1 D1 E1 F1 High loss2 A2 B2 D2 E2 F2 High jitter 3 A3 B3 D3 E3 F3 High loss and jitter . . .d Ad Bd Dd Ed Fd

Table 1 is an Example Illustration of a Data set, in accordance with anembodiment.

In the first data point corresponding to the timed sequence in the rowin Table 1 at time 1, the parameter link utilization has a value of A1,the parameter link latency has a value of B1, the parameter number ofconnections has a value of D1, the parameter synchronized TCP connectionhas a value of E1 and the parameter queue size has a value of F1. Attime 1, the values A1, B1, D1, E1 and F1 can correspond to aclassification or category of “high loss”. The classifier 504 a, orother monitor of appliance 200 a, can determine that at time 1, theperformance of the link was such that there was a high amount of datapacket loss based on the amount of data loss being greater than apredetermined loss threshold. The appliance 200 a can create an entry inthe training set that indicates the values of the parameters and thecorresponding class.

In the second data point corresponding to the timed sequence in the rowin Table 1 at time 2, the parameter link utilization has a value of A2,the parameter link latency has a value of B2, the parameter number ofconnections has a value of D2, the parameter synchronized TCP connectionhas a value of E2 and the parameter queue size has a value of F2. Attime 2, the values A2, B2, D2, E2 and F2 can correspond to aclassification or category of “high jitter”. The classifier 504 a, orother monitor of appliance 200 a, can determine that at time 2, theperformance of the link was such that there was a high amount ofvariance between the times at which packets are received at adestination as compared to a periodic time interval at which the datapackets are transmitted on the link, where the variance is greater thana predetermined jitter threshold. The appliance 200 a can create anentry in the training set that indicates the values of the parametersand the corresponding class.

In the third data point corresponding to the timed sequence in the rowin Table 1 at time 3, the parameter link utilization has a value of A3,the parameter link latency has a value of B3, the parameter number ofconnections has a value of D3, the parameter synchronized TCP connectionhas a value of E3 and the parameter queue size has a value of F3. Attime 3, the values A3, B3, D3, E3 and F3 can correspond to aclassification or category of “high loss and high jitter”. Theclassifier 504 a, or other monitor of appliance 200 a, can determinethat at time 3, the performance of the link was such that there was ahigh amount packet loss in addition to a high amount of variance betweenthe times at which packets are received at a destination as compared toa periodic time interval at which the data packets are transmitted onthe link, where the packet loss is greater than a predetermined lossthreshold and where the variance is greater than a predetermined jitterthreshold. The appliance 200 a can create an entry in the training setthat indicates the values of the parameters and the corresponding class.

The classifier 504 a, via a machine learning technique, can use theclassifications in the training set as instances of supervised learning,e.g., learning where a training set of correctly identified observationsis available. The parameters in the training set can be referred to asexplanatory variables or features. The classifier 504 a can then performa corresponding unsupervised procedure, such as clustering, to groupdata into classes or categories based on a measure of similarity ordistance between a new set of observed parameters with the training set.For example, the classifier 504 a can be configured with a mathematicalfunction or classification algorithm that maps input parameter data to acategory or class.

Example classification techniques can include regressions, logisticregressions, Bayesian procedures, neural networks, linear functions,Long Short Term Memory (LSTM) Recurrent Neural Network (RNN) classifier,etc. For example, the classifier 504 a can perform a logistic regressionwhere the observed parameters are termed explanatory variables and theclasses or categories to be predicted are outcomes, which are consideredto be possible values of the dependent variable. The classifier 504 acan use a machine learning in which the observed parameters can beinstances, the explanatory variables can be features (grouped into afeature vector), and the possible categories to be predicted areclasses.

In some embodiments, the classifier 504 a includes, is configured with,or otherwise accesses an LSTM Recurrent neural network classifier thatcan learn the stream of timed sequences of data points of the trainingset illustrated in Table 1. The classifier 504 a, configured with Longshort-term memory, can use an artificial neural network architecturethat supports machine learning. The classifier 504 a can be recurrent(RNN), allowing data to flow both forwards and backwards within thenetwork. The classifier 504 a can interface, access, or utilizeadditional network units. The classifier 504 a can use the LSTM RNN tolearn from the training set to classify, process and predict time seriesgiven time lags of unknown size and bound between important events. Theclassifier 504 a can, during a training or re-training process,establish weights for the parameters or the classes.

Thus, the classifier 504 a can provide a second prediction for thehealth of the link using a technique that is different from thetechnique used by the rule engine 502 a to provide the first predictionof the health of the link. The appliance 200 a can then analyze,process, or compare the first prediction with the second prediction. Theappliance 200 a can process the first and second predictions. Theappliance 200 a can manipulate or modify the first and secondpredictions prior to selecting the predictions or combining thepredictions.

For example, the appliance can include a weight adjuster 506 a. Theweight adjusted 506 a can establish a respective weight for each of thefirst prediction of health and the second prediction of heath. Theweight adjuster 506 a may determine weights to apply to the firstprediction and the second prediction. The weight adjuster 506 a candetermine and apply weights to the predictions based on the techniquesused to make the predictions. For example, the weight adjuster 506 a canapply a first weight to the first predictions based on the firstpredictions being made by the rule engine 502 a; and apply a secondweight to the second prediction based on the second prediction beingmade by the classifier 504 a. The weight adjuster 504 a may determine aweight for the second prediction made by the classifier 504 a based onthe amount or size of the training set or historical data pointsavailable to the classifier 504 a. For example, the pattern learnt byclassifier 504 a about different link state classes may be under fittedin an initial or early phase because the classifier 504 a may haveaccess to only a few data points. Accordingly, the appliance 200 a canbe configured to not overly rely on the prediction made by theclassifier 504 a.

The weight adjuster 506 a, therefore, can establish or define a weightvariable W_(class) for the weight to apply to the prediction made by theclassifier, and a weight variable W_(rule) to apply to the predictionmade by the rule engine 502 a. These weight variables can allow theappliance 200 a to select a prediction.

The weight adjuster 506 a can adjust the weights by increasing a weightfor a technique if the corresponding prediction is correct (e.g.,incentivize), or decreasing the weight if the prediction is wrong (e.g.,penalize). Weights can be predetermined or determined based on afunction. The weight can be based on the number of data points to whichthe classifier 504 a has access. The weights can be determined based ona comparison of the predictions. For example, each time the predictionoutput by the classifier 504 a matches or corresponds to the predictionmade by the rule engine 502 a, the weight W_(Class) can be increased.For example, the weight W_(Class) can be incremented by a number (e.g.,incremented by 1, 2, 3, 4, 5, etc.) responsive to the prediction outputby the classifier 504 a matching the prediction output by the ruleengine 502 a. However, if the prediction output by the classifier 504 adoes not match the prediction output by the rule engine 502 a, theweight adjuster 506 a and decrement W_(Class) by a number (e.g., 1, 2,3, 4, 5, etc.). The weight adjuster 506 a can increment or decrement theweight by the same amount or different amounts. For example, the weightadjuster 506 a can provide a greater incentive relative to penalty byusing a number for the increment that is greater than the decrement.

The weight adjuster 506 a can use other techniques or factors to assignweights W_(class) and W_(rule). For example, the weight W_(class) can bebased on the number of data points in the training set (e.g., the weightcan be 3 based on the 3 data points shown in the training setillustrated in Table 1). The W_(rule) can be set a fixed value, such as2, 3, 4, 5 etc.

The appliance 200 a can use the weights to select or determine a finalprediction of health of the link. The appliance 200 a can include aprediction selector 508 a that selects, using the respective weightsW_(class) and W_(rule), between the first prediction of health and thesecond prediction of health to provide a predictor of the health of thelink. The following pseudocode illustrates an implementation of applyingthe weight function f(Pred, W):

If (W_(Class) > W_(Rule)) { FinalPrediction = PredClass; } else {FinalPrediction = PredRule; }

In the illustrated pseudo code, FinalPrediction can refer to the finalprediction selected by the prediction selector 508 a; PredClass canrefer to the prediction outcome made by the classifier 504 a; andPredRule can refer to the prediction outcome made by the rule engine 502a. As illustrated in the pseudocode, the prediction selector 508 a cancompare the W_(Class) with W_(Rule). If W_(class) is greater thanW_(Rule), the prediction selector 508 a can set the final prediction asthe prediction output by the classifier 504 a. If, however, W_(Class) isless than or equal to W_(Rule), the prediction selector 508 a can setthe final prediction as the prediction output by the rule engine 502 a.In some cases, W_(Rule) can be referred to as a first weight and beapplied to the first prediction made by the rule engine 502 a; andW_(class) can be referred to as a second weight and be applied to thesecond prediction made by the classifier 504 a.

The appliance 200 a (e.g., prediction selector 508 a) can be configuredto take a preventive action. For example, having predicted the cause ofthe link going bad, the appliance 200 a can take preventive actions toprevent the link from entering a bad state. For example, if theFinalPred is high latency, the appliance 200 a can move connections withhigh packet occupancy in the queue to other links. In another example,if the FinalPred is high jitter, the appliance 200 a can moveconnections whose difference in inter-arrival time into the applianceand inter-departure time out of the queue is very high. In yet anotherexample, if the FinalPred of the link going bad is high loss, theappliance 200 a can send only 90% of the bandwidth (e.g., for a 10 Mbpslink, the appliance 200 a may transmit only 9 Mbps). In yet anotherexample, if the FinalPred is high loss and high jitter, the appliance200 a can both move connections whose difference in inter-arrival timeinto the appliance and inter-departure time out of the queue is veryhigh and send only 90% of the bandwidth of the link.

Thus, the appliance 200 a can be configured to take an action associatedwith the link responsive to the predictor of the health of the link thatis selected from predictions made by a rule engine and classifier basedon weights. For example, the appliance 200 a can identify via theselected predictor of the health of the link, that the link has highlatency based on a predetermined latency threshold. The appliance 200 acan, responsive to the prediction that the link has high latency, moveone or more connections with packet occupancy greater than apredetermined occupancy threshold in a queue to one or more other links.In another example, the appliance 200 a can identify via the selectedpredictor of the health of the link, that the link has high jitter basedon a predetermined jitter threshold. Responsive to predicting that thehealth of the link corresponds to high jitter, the appliance 200 a canmove one or more connections with a difference in inter-arrival timeinto the appliance 200 a and inter-departure time of a queue of theappliance 200 a that is above a predetermined threshold. In yet anotherexample, the appliance 200 a can identify via the selected predictor ofthe health of the link, that the link has high loss based on apredetermined loss threshold and transmit by the device a predeterminedportion of bandwidth via the link.

Referring now to FIG. 5B, depicted is a block diagram of a sequence ofoperations for predicting health of a link. The operation 518 can beperformed by one or more system or component depicted in FIG. 5A,including, for example, the rule engine 502 a, classifier 504 a, weightadjuster 506 a, and prediction selector 508 a. The operation of thesystem 518 progresses based on time 522 to monitor the health of thelink 520, where the health can be latency, jitter, throughput, ortime-to-live (TTL) of a packet of the link. The TTL can be a value inthe internet protocol that can indicate the amount of time a packet hasbeen in the link. Over the time 522, data 524 data 524 can be providedas input to the classifier 504 a. Data 524 can also be input to the ruleengine 502 a. The data 524 can include, for example, profile informationabout a link, such as parameters, values for parameters, a training setor current parameters. Same or different data 524 can be provided to theclassifier 504 a as compared to the rule engine 502 a. In some cases,the data can be pre-processed or filtered differently for the ruleengine 502 a as compared to the classifier 504 a.

The classifier 504 a can output a predictor of the health of the linkPred_(class) 530 using the data 524. The rule engine 502 a can output apredictor of the health of the link Pred_(rule) 532 using the data 524.The classifier 504 a can provide the Pred_(class) 530 to the weightadjuster 506 a. The rule engine 502 a can provide the Pred_(rule) 532 tothe weight adjuster 506 a. The weight adjuster 506 a can identifyweights for the Pred_(Class) 530 and Pred_(rule) 532. For example, theweight adjuster 506 a can identify W_(Class) 538 for the Pred_(Class)530 and W_(Rule) 540 for Pred_(rule) 532. In some cases, the weightadjuster 506 a can increment or decrement the weights. The weightadjuster can increment or decrement the weights based on an actualoutcome 536. For example, during a supervised learning process, theweight adjuster 506 a can receive actual outcomes 536 of the health ofthe link, compare the actual outcome 536 with the predicted outcomesreceived from the rule engine and classifier, and then assign or adjustweights based on the comparison. For example, if the classifier 504 aprovides a prediction that matches the actual outcome 536, the weightadjuster 506 a can increment the weight for the classifier. If the ruleengine provides a prediction that matches the actual outcome 536, theweight adjuster can increment the weight for the rule engine. If theclassifier 504 a provides a prediction that does not match the actualoutcome 536, the weight adjuster 506 a can decrement the weight for theclassifier. If the rule engine provides a prediction that does not matchthe actual outcome 536, the weight adjuster can decrement the weight forthe rule engine. In some cases, the actual outcome 536 can refer to anoutcome received via data 524 at a point in time subsequent to when theprediction for the health of the link was made. For example, the system500 can provide a prediction of a future health the link, and then thesystem 500 can receive the actual health of the link and compare theactual health with the prediction to determine the accuracy of theprediction.

The weight adjuster 506 a can provide the W_(Class) 538 and W_(Rule) 540to the prediction selector 508 a. The prediction selector 508 a canexecute a function f(Pred, W) that takes, as input, the Pred_(class) 530and Pred_(rule) 532 and W_(Class) 538 and W_(Rule) 540 to select a finalprediction. The final prediction can be one of the Pred_(class) 530 andPred_(rule) 532 based on the respective weights W_(Class) 538 andW_(Rule) 540.

Referring now to FIG. 5C, a flow diagram of a method of predictinghealth of a link in accordance with an embodiment is shown. Theoperations and functionalities of method 550 can be implemented usingthe system 500 described above. In brief overview, a device (e.g.,appliance 200 a or appliance 200 b) intermediary between a client and aserver can identify a profile at block 552. At block 554, the device candetermine one or more predictions. At block 556, the device canestablish weights. At block 556, the device can select a prediction.

In further detail, referring to block 552, and in some embodiments, thedevice intermediary between a client and a server can identify profileinformation. The device can be in communication with one or more linksin a network. The profile information can include data about a link in anetwork. The profile information can include current data indicative ofthe health of the link. The profile information can be about a stream ofnetwork traffic traversing the link. The profile information can includea plurality of parameters about the link. The profile information caninclude a training set, historical data, configuration information, orinstructions. In some cases, the profile information can include rulesor classification techniques, or thresholds that can be used todetermine or predict the health of the link.

The device can receive the profile information or other data via anetwork. The device can receive the profile information or other datavia a data file, input/output port, server or client. The device, insome cases, can retrieve the profile information from a data file storedin memory of the device.

At block 554, the device can determine predictions. The device candetermine predictions about the health of the link or a state of thelink. The prediction can be about a current health of the link, or afuture health of the link. The device can determine multiple predictionsusing multipole techniques. For example, the device can determine afirst prediction of the health of the link using a first technique, anddetermine a second prediction of the health of the link using a secondtechnique. The device can be configured to determine both predictionsusing the same or different input profile information. The device can beconfigured to determine the first prediction and the second predictionat the same time, simultaneously, in an overlapping manner, or serially.The device can determine the first prediction using a static rule-basedtechnique, and determine the second prediction using an online machinelearning classifier based technique, for example. The device candetermine a second prediction of health of the link by applying aclassifier to one or more timed sequences of the plurality of parametersof the profile information.

In some cases, the device can determine to make only a single predictionusing a single technique. For example, the device can determine, basedon weights associated with the different prediction techniques, that theweight for a prediction technique is greater than a threshold.Responsive to determining that a weight for a technique is greater thana threshold, the device can determine to apply only the singleprediction technique corresponding to the weight greater than thethreshold. In some cases, the device can determine to utilize multipleprediction techniques responsive to the weight being less than athreshold.

At block 556, the device can establish one or more weights. The devicecan establish a respective weight for each of the first prediction ofhealth and the second prediction of heath. The weight can indicate adegree of confidence in the respective prediction techniques. The weightcan be predetermined, or dynamically determined. The device can adjustor modify the weight over time. For example, the device can increase theweight for a prediction technique responsive to determining that theprediction technique performed in a satisfactory manner, such as outputa prediction that matches a desired prediction outcome. The weight canbe set based on a similarity of prediction outcomes to a training set,or based on a supervised learning process.

At block 558, the device can select a prediction to make a finalprediction. The device can select, using the respective weight, betweenthe first prediction of health and the second prediction of health toprovide the final predictor of the health of the link. The device cancompare the weights of the predictors to determine which prediction toselect. The weights can correspond to the different predictiontechniques.

The device can take or perform actions based on the final prediction ofthe health of the link. The device can proactively load balance acrosslinks based on the prediction of the health of the link. For example, ifthere are multiple available links via which traffic can be transmitted,the device can move traffic from a link corresponding to a bad state toa different link that is in a good state. In another example, the devicecan proactively reduce a maximum available bandwidth of the link to 90%,for example, responsive to the prediction of the health of the link. Forexample, if the predicted cause of the link going bad is high loss, thedevice can send only 90% of the bandwidth (e.g., for a 10 Mbps link, thedevice may transmit only 9 Mbps). Thus, the device can proactively linkload balance to improve the overall performance of the network, increasereliability, and reduce wasted resources and network delays.Furthermore, improving the performance of the network can improve theperformance of client devices or servers that access the network bytimely providing the client devices and servers with the requested data.

Various elements, which are described herein in the context of one ormore embodiments, can be provided separately or in any suitablesubcombination. For example, the processes described herein can beimplemented in hardware, or a combination of hardware and software.Further, the processes described herein are not limited to the specificembodiments described. For example, the processes described herein arenot limited to the specific processing order described herein and,rather, process blocks can be re-ordered, combined, removed, orperformed in parallel or in serial, or in response to another processblock, as necessary, to achieve the results set forth herein.

It will be further understood that various changes in the details,materials, and arrangements of the parts that have been described andillustrated herein can be made by those skilled in the art withoutdeparting from the scope of the following claims.

1-20. (canceled)
 21. A method, comprising: (a) identifying, by a device,a plurality of parameters about a link in communication with the device;(b) applying, by the device, one or more rules to the plurality ofparameters of the link to establish a first prediction of health of thelink; (c) establishing, by a classifier, a second prediction of healthof the link based at least on the plurality of parameters; (d)identifying, by the device, one of the first prediction of health or thesecond prediction of health as a health of the link based at least on arespective weight of each of the first prediction of health and thesecond prediction of health; and (e) reducing, by the device, a use ofthe link based at least on the health of the link.
 22. The method ofclaim 21, wherein (a) further comprises identifying, by the device, theplurality of parameters from network traffic traversing the device andcommunicated via the link.
 23. The method of claim 21, wherein theplurality of parameters comprises one or more of the following: latency,utilization, loss of packets, jitter, queue size, number of connections,and type of connection.
 24. The method of claim 21, wherein (b) furthercomprises applying, by the device, the one or more rules as a functionof the plurality of parameters.
 25. The method of claim 21, wherein (c)further comprises applying, by the device, the classifier to timedsequences of the plurality of parameters.
 26. The method of claim 25,further comprising creating the one or more timed sequences of theplurality of parameters responsive to the health of the link one ofclimbing above or falling below a predetermined threshold.
 27. Themethod of claim 21, wherein (d) further comprises applying a function tothe respective weight of the first prediction of health and the secondprediction of health to select between the first prediction of healthand the second prediction of health.
 28. The method of claim 21, furthercomprising determining, by the device responsive to comparing the healthof the link to a threshold, that the link has one of high latency, highjitter or high loss.
 29. The method of claim 28, further comprisingcausing, by the device responsive to the determination, one or moreconnections in a queue of the device to use a different link.
 30. Themethod of claim 28, further comprising using, by the device responsiveto the determination, a predetermined portion of bandwidth via the link.31. A system comprising: a device comprising one or more processors,coupled to memory and configured to: identify a plurality of parametersabout a link in communication with the device; apply one or more rulesto the plurality of parameters of the link to establish a firstprediction of health of the link; establish via a classifier based atleast on the plurality of parameters a second prediction of health ofthe link; identify one of the first prediction of health or the secondprediction of health as a health of the link based at least on arespective weight of each of the first prediction of health and thesecond prediction of health; and reduce a use of the link based at leaston the health of the link.
 32. The system of claim 31, wherein thedevice is further configured to identify the plurality of parametersfrom network traffic traversing the device and communicated via thelink.
 33. The system of claim 31, wherein the plurality of parameterscomprises one or more of the following: latency, utilization, loss ofpackets, jitter, queue size, number of connections, and type ofconnection.
 34. The system of claim 31, wherein the device is furtherconfigured to apply the one or more rules as a function of the pluralityof parameters.
 35. The system of claim 31, wherein the device is furtherconfigured to apply the classifier to timed sequences of the pluralityof parameters.
 36. The system of claim 35, wherein the device is furtherconfigured to creating the one or more timed sequences of the pluralityof parameters responsive to the health of the link one of climbing aboveor falling below a predetermined threshold.
 37. The system of claim 31,wherein the device is further configured to apply a function to therespective weight of the first prediction of health and the secondprediction of health to select between the first prediction of healthand the second prediction of health.
 38. The system of claim 31, whereinthe device is further configured to determine, responsive to comparingthe health of the link to a threshold, that the link has one of highlatency, high jitter or high loss.
 39. The system of claim 38, whereinthe device is further configured to cause, responsive to thedetermination, one or more connections in a queue of the device to use adifferent link.
 40. The system of claim 38, wherein the device isfurther configured to use, responsive to the determination, apredetermined portion of bandwidth via the link.